fix: run host audit guard test as non-root

docs/operations/CI_RUNNER.md

@@ -251,4 +251,9 @@ hooks; this installer change has not been applied to the VPS. On the updated
 PR head `7701e77`, CI run 51 also failed after task 303 was accepted, while
 smoke run 52 passed. The daemon log still exposes no job or step detail and
 the Actions jobs endpoint is empty for run 51, so its failure remains
-unattributed.
+unattributed. The owner later provided the full log for task 305 (run 53):
+`Check host audit root guard` exited 1 before Docker builds began. The test had
+assumed its caller was non-root, but Gitea job commands run as root in this
+container. The test now uses `setpriv` to invoke the audit as UID 65534 when
+the test itself starts as root; the audit's root-only guard is unchanged. It
+prints a diagnostic and captured output if that assertion fails.

docs/operations/CURRENT_STATE.md

@@ -148,6 +148,14 @@ unverified.
   dispatch lines. Gitea returns no jobs for run 303, and the owner-only jobs
   endpoint remains unavailable to the current API account, so run 51's failed
   step is also undetermined. This repeated result does not establish a cause.
+- The owner supplied the complete log for task 305 (run 53): the failure was
+  `Check host audit root guard`, exit 1. Earlier backend (37 tests, 1 skipped),
+  Telegram (6), backup/restore (16), recovery host identity guard, and verifier
+  helper guard passed; Docker image builds were not reached. Reproduction with
+  `EUID=0` and `bash -x` confirmed the test ran the audit as root and then failed
+  because the expected non-root denial message was absent. The workflow job
+  container runs commands as root, so the regression test now drops to UID
+  65534 with `setpriv` before invoking the unchanged root guard.
 - An isolated local Compose smoke test built backend/OpenSearch images,
   reached healthy status for OpenSearch, backend, and Caddy, and returned HTTP
   200 for `/review` through Caddy. Its containers, networks, and volumes were

infra/bootstrap/test-audit-host.sh

@@ -3,8 +3,27 @@ set -euo pipefail
 
 output=$(mktemp)
 trap 'rm -f "$output"' EXIT
-if bash "$(dirname "$0")/audit-host.sh" >"$output" 2>&1; then
-  echo 'Host audit unexpectedly succeeded without root.' >&2
+audit_script="$(dirname "$0")/audit-host.sh"
+if [[ $EUID -eq 0 ]]; then
+  if ! command -v setpriv >/dev/null 2>&1; then
+    echo 'Cannot test the host audit root guard as root: setpriv is required.' >&2
+    exit 1
+  fi
+  if setpriv --reuid=65534 --regid=65534 --clear-groups -- bash "$audit_script" >"$output" 2>&1; then
+    audit_status=0
+  else
+    audit_status=$?
+  fi
+else
+  if bash "$audit_script" >"$output" 2>&1; then
+    audit_status=0
+  else
+    audit_status=$?
+  fi
+fi
+if ! grep -Fqx 'Run this read-only audit as root.' "$output"; then
+  echo "Host audit root guard did not reject unprivileged execution (audit exit code: $audit_status). Output:" >&2
+  cat "$output" >&2
   exit 1
 fi
-grep -qx 'Run this read-only audit as root.' "$output"
+echo 'PASS host audit root guard rejects unprivileged execution'